Guides

The SEC's cyber incident disclosure rules

Public companies must file Form 8-K Item 1.05 within four business days of finding a cyber incident material. The rule, its 2026 status and insurance links.

4BusinessInsurance · Published October 10, 2026

Since December 18, 2023 (June 15, 2024 for smaller reporting companies), a public company that determines a cybersecurity incident is material must disclose it on Form 8-K, Item 1.05, generally within four business days of that determination. Separately, every annual report must describe how the company manages cyber risk and how its board oversees it, under Regulation S-K Item 106. The rules apply to SEC registrants only, and as of October 2026 they remain in force while industry groups push the SEC to roll them back. Private businesses are affected indirectly, through public customers, deals and insurance.

Who is covered, and when it started

The SEC adopted the rules on July 26, 2023, effective September 5, 2023. According to the SEC's fact sheet and its small entity compliance guide:

  • Item 106 disclosures were required in annual reports for fiscal years ending on or after December 15, 2023.
  • Item 1.05 reporting began December 18, 2023 for most registrants and June 15, 2024 for smaller reporting companies.
  • Foreign private issuers follow comparable rules through Form 6-K for incidents and Form 20-F for annual disclosure.

A company that is not an SEC registrant has no Form 8-K duty. State breach laws, contracts and its insurance policy still apply (data breach notification laws and what they cost).

What Item 1.05 requires

The text of the rule, as published in the Federal Register on August 4, 2023, has these working parts:

  • Trigger. A "cybersecurity incident" that the company determines is material. The definition covers an unauthorized occurrence, or a series of related ones, on or conducted through the company's information systems that jeopardizes the confidentiality, integrity or availability of the systems or the information in them.
  • Content. The material aspects of the nature, scope and timing of the incident, and its material impact or reasonably likely material impact, including on financial condition and results of operations.
  • Clock. The filing is due within four business days after the materiality determination, not after discovery. But the determination itself must be made without unreasonable delay after discovery. A company cannot stall the clock by not deciding.
  • Gaps in knowledge. If required details are not yet known, the filing says so and the company must amend it within four business days after it determines or learns the information.
  • No roadmap for attackers. The company need not disclose specific technical information about its planned response, systems or vulnerabilities in such detail as would impede its response or remediation.
  • National security delay. If the U.S. Attorney General determines that disclosure poses a substantial risk to national security or public safety and tells the SEC in writing, the company may delay for up to 30 days, then up to another 30, and in extraordinary circumstances a final 60. The SEC's staff says a request for a delay does not itself move the deadline; the Attorney General's written notice must arrive before the filing is otherwise due (C&DI 104B.01).

What Item 106 requires

In the annual report, a company describes its processes for assessing, identifying and managing material cybersecurity risks and whether such risks have materially affected, or are reasonably likely to materially affect, the company. It also describes the board's oversight of cyber risk, including any responsible committee, and management's role and expertise. These statements matter beyond compliance, because plaintiffs and regulators compare them with what actually happened.

How the SEC staff reads materiality

The staff has published guidance that closes several tempting shortcuts:

  • A ransom payment does not end the analysis. Under the June 24, 2024 compliance and disclosure interpretations (C&DIs 104B.05 to 104B.08), paying a ransom, or an attacker ceasing to disrupt, does not relieve a company of the duty to assess materiality or to report an incident already found material. The size of a payment is one fact among many, and the Commission declined to set a dollar trigger. See paying a ransom: sanctions risk and reporting rules for the payment side.
  • Insurance recovery does not make an incident immaterial. C&DI 104B.07 says reimbursement of a payment by insurance does not automatically make an incident immaterial, and the company's analysis may consider the availability of, or an increase in the cost of, its insurance.
  • Related incidents add up. Individually immaterial incidents may be reportable if they are related and together are material (C&DI 104B.09).
  • Use the right item. In a May 21, 2024 statement, the Division of Corporation Finance's director said Item 1.05 is for incidents determined to be material, and encouraged companies disclosing other incidents, or ones not yet assessed, to use Item 8.01 instead. If an Item 8.01 incident is later found material, an Item 1.05 filing follows within four business days.

Where the rules stand in October 2026

The rules have not been repealed or amended. In May 2025, a group of financial-industry trade associations petitioned the SEC to rescind Item 1.05 and the related Form 6-K requirements (SEC petition page). In January 2026, SEC Chairman Paul Atkins launched a review of Regulation S-K and asked for comment by April 13, 2026, and comment letters since, including one from the wireless trade group CTIA dated October 2, 2026, continue to urge rescission of Item 106 and Item 1.05. We found no SEC proposal to change either item. Treat the rules as binding until the Commission acts.

On enforcement, the SEC, SolarWinds and its chief information security officer jointly dismissed with prejudice the SEC's case against them on November 20, 2025. The case had centered on the company's cybersecurity statements before its incident. This is according to Covington and Morrison Foerster. That case concerned pre-incident statements, not Item 1.05, and law firms caution against reading the dismissal as a retreat from cyber disclosure.

The insurance connections

  1. Your incident response plan needs a disclosure path. A public company's plan should escalate to the disclosure committee and securities counsel as well as to the insurer's hotline. building an incident response plan your insurer will like covers the operational side.
  2. Notice to carriers. A material incident may prompt claims against the company and its directors and officers. Give notice to the cyber carrier and to the D&O carrier, under the claims-made rules each form sets, before or alongside the filing. See notice of claim.
  3. What the cyber policy pays. The first-party response costs and defense of a regulatory proceeding may be covered; fines and penalties only "where insurable by law" (are fines, penalties and punitive damages insurable?).
  4. D&O. A stock drop after an 8-K can lead to a securities class action, which sits under the D&O policy (Directors and officers (D&O) insurance explained, Securities class actions and the D&O market). Check whether the D&O form has a cyber or privacy exclusion and how it is carved back.
  5. Public statements. Disclosure language can look like an admission to a plaintiff. Cyber forms commonly require the insurer's consent to admit liability, so have counsel and the carrier review sensitive wording where the timing allows.

A hypothetical timeline

Say a public manufacturer discovers ransomware on Monday, October 5. Forensics and counsel work with the company's disclosure committee, and on Wednesday, October 21, the committee concludes that production outages and likely customer losses make the incident material. Four business days from that determination runs through Tuesday, October 27, the filing date. The Form 8-K describes what is known and says that the cost, the data involved and the insurance recovery are still being determined, and the company later files an amendment. If the company had waited until October 28 only to "finish the analysis," the SEC could say the determination itself was unreasonably delayed. The dates and facts are invented to show the mechanics.

Key takeaways

  • Item 1.05 requires public companies to file a Form 8-K within four business days after determining a cyber incident is material, and Item 106 requires annual disclosure of cyber risk management and board oversight.
  • The materiality decision must be made without unreasonable delay, and a ransom payment, a quiet system or an insurance recovery does not by itself make an incident immaterial.
  • As of October 2026 the rules stand, with rescission requests pending and no SEC proposal found. The SolarWinds case was dismissed in November 2025.
  • Private companies feel the rule through public customers, transactions and insurance, and everyone should tie incident response to legal notice and to carrier notice.
  • Coordinate cyber and D&O carriers early, because the filing can start both a cyber claim and a securities claim.

Terms used in this guide

Directors and officers (D&O) insurance Liability insurance protecting a company's directors and officers, and often the company itself, against claims alleging wrongful acts in managing the business. Claims-made policy A liability policy that covers claims first made against you and reported to the insurer during the policy period, whenever the underlying act occurred. Notice of claim The report a policyholder must give an insurer about a loss, claim or lawsuit. The policy sets the timing, and late notice can put coverage at risk. Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Exclusion A policy provision that removes coverage for specified perils, property, people or types of loss that the insuring agreement would otherwise include. First-party coverage Insurance that pays the policyholder directly for its own losses, such as damaged property or breach response costs, rather than defending claims by others.

Related tools

Cyber insurance readiness checklist Rate 25 security controls yes, partly or no to see your readiness score, your gaps and which controls cyber insurance applications commonly ask about.

Latest on this topic